chore(release): brew-release.sh + deploy.env.example scaffolding

@@ -1 +1,2 @@
 bin/
+/deploy/deploy.env

@@ -0,0 +1,5 @@
+# Copy to deploy/deploy.env (gitignored) and fill in. Used by scripts/brew-release.sh.
+REMOTE=          # ssh host alias, e.g. codex
+DOMAIN=          # public domain serving /dl and /git, e.g. codex.humdrum.me
+REPOS_PATH=      # server path to the bare git repos, e.g. /var/lib/soft-serve/data/repos
+RUN_USER=        # OS user that owns the repos on the server

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+#
+# brew-release.sh [version]
+#
+# Release tt to the self-hosted Homebrew tap — no GitHub. Archives the tag
+# straight from the server's bare repo into a source tarball under /dl, then
+# writes/updates the source-build formula in the `homebrew-tap` repo and pushes.
+#
+#   scripts/brew-release.sh v0.1.0
+#
+# Prereqs: the tag exists in the `tt` repo on the server; deploy/deploy.env is
+# filled (REMOTE, DOMAIN, REPOS_PATH, RUN_USER); the `homebrew-tap` repo exists
+# on the server. Users then:
+#   brew tap humdrum/tap https://DOMAIN/git/homebrew-tap.git && brew install tt
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+REPO="tt"
+PKG="./cmd/ticktock"
+VERSION="${1:?usage: brew-release.sh <version>}"
+VER="${VERSION#v}" # strip leading v for tarball/version string
+
+[ -f deploy/deploy.env ] || { echo "missing deploy/deploy.env (see deploy/deploy.env.example)" >&2; exit 1; }
+set -a; . deploy/deploy.env; set +a
+: "${REMOTE:?}"; : "${DOMAIN:?}"; : "${REPOS_PATH:?}"; : "${RUN_USER:?}"
+
+TARBALL="${REPO}-${VER}.tar.gz"
+URL="https://${DOMAIN}/dl/${TARBALL}"
+HOMEPAGE="https://${DOMAIN}/r/${REPO}"
+CLASS="Tt"
+DESC="Charm-native front-end for the tock time tracker"
+
+echo "==> archiving ${REPO}@${VERSION} from the server"
+# Run as the repo owner so git doesn't reject "dubious ownership".
+ssh "$REMOTE" "sudo -u ${RUN_USER} git -C '${REPOS_PATH}/${REPO}.git' archive --format=tar.gz --prefix='${REPO}-${VER}/' '${VERSION}'" > "/tmp/${TARBALL}"
+SHA="$(shasum -a 256 "/tmp/${TARBALL}" | awk '{print $1}')"
+echo "    ${TARBALL}  sha256=${SHA}"
+
+echo "==> publishing tarball to /dl"
+ssh "$REMOTE" "install -d -o caddy -g caddy /var/lib/custard/dl"
+scp -q "/tmp/${TARBALL}" "$REMOTE:/var/lib/custard/dl/${TARBALL}"
+
+echo "==> updating the tap formula"
+TAP="$(mktemp -d)"
+git clone -q "soft:homebrew-tap" "$TAP"
+mkdir -p "$TAP/Formula"
+cat > "$TAP/Formula/${REPO}.rb" <<EOF
+# Generated by tt brew-release.sh — do not edit by hand.
+class ${CLASS} < Formula
+  desc "${DESC}"
+  homepage "${HOMEPAGE}"
+  url "${URL}"
+  sha256 "${SHA}"
+  license "AGPL-3.0-or-later"
+
+  depends_on "go" => :build
+
+  def install
+    system "go", "build", *std_go_args(ldflags: "-s -w -X main.version=#{version}"), "${PKG}"
+  end
+
+  test do
+    assert_path_exists bin/"${REPO}"
+  end
+end
+EOF
+git -C "$TAP" add "Formula/${REPO}.rb"
+git -C "$TAP" -c user.name="tt" -c user.email="tt@${DOMAIN}" \
+  commit -q -m "${REPO} ${VERSION}"
+git -C "$TAP" push -q origin HEAD
+rm -rf "$TAP"
+
+echo "==> done"
+echo "    brew tap humdrum/tap https://${DOMAIN}/git/homebrew-tap.git"
+echo "    brew trust humdrum/tap"
+echo "    brew install ${REPO}"